Fix authentication issues with the http-requests against the proxy

.changeset/smart-peas-mate.md

@@ -0,0 +1,5 @@
+---
+'@roadiehq/scaffolder-backend-module-http-request': patch
+---
+
+Fix authentication to the proxy in the scaffolder action

plugins/scaffolder-actions/scaffolder-backend-module-http-request/src/actions/run/backstageRequest.ts

@@ -14,19 +14,17 @@
  * limitations under the License.
  */
 
-import { createTemplateAction } from '@backstage/plugin-scaffolder-backend';
-import {
-  generateBackstageUrl,
-  http,
-  getObjFieldCaseInsensitively,
-} from './helpers';
+import { createTemplateAction } from '@backstage/plugin-scaffolder-node';
+import { generateBackstageUrl, http } from './helpers';
 import { HttpOptions, Headers, Params, Methods, Body } from './types';
 import { DiscoveryApi } from '@backstage/core-plugin-api';
+import { AuthService } from '@backstage/backend-plugin-api';
 
 export function createHttpBackstageAction(options: {
   discovery: DiscoveryApi;
+  auth?: AuthService;
 }) {
-  const { discovery } = options;
+  const { discovery, auth } = options;
   return createTemplateAction<{
     path: string;
     method: Methods;
@@ -117,7 +115,10 @@ export function createHttpBackstageAction(options: {
 
     async handler(ctx) {
       const { input } = ctx;
-      const token = ctx.secrets?.backstageToken;
+      const { token } = (await auth?.getPluginRequestToken({
+        onBehalfOf: await ctx.getInitiatorCredentials(),
+        targetPluginId: 'proxy',
+      })) ?? { token: ctx.secrets?.backstageToken };
       const { method, params } = input;
       const logRequestPath = input.logRequestPath ?? true;
       const continueOnBadResponse = input.continueOnBadResponse || false;
@@ -158,12 +159,7 @@ export function createHttpBackstageAction(options: {
         body: inputBody,
       };
 
-      const authToken = getObjFieldCaseInsensitively(
-        input.headers,
-        'authorization',
-      );
-
-      if (token && !authToken) {
+      if (token) {
         ctx.logger.info(`Token is defined. Setting authorization header.`);
         httpOptions.headers.authorization = `Bearer ${token}`;
       }

plugins/scaffolder-actions/scaffolder-backend-module-http-request/src/actions/run/helpers.test.ts

@@ -13,11 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import {
-  generateBackstageUrl,
-  http,
-  getObjFieldCaseInsensitively,
-} from './helpers';
+import { generateBackstageUrl, http } from './helpers';
 import { HttpOptions } from './types';
 import { getRootLogger } from '@backstage/backend-common';
 import { Writable } from 'stream';
@@ -206,38 +202,6 @@ describe('http', () => {
         });
       });
 
-      describe('get auth header properly', () => {
-        const TOKEN = 'Bearer 12345';
-
-        it('finds auth token', async () => {
-          expect(
-            getObjFieldCaseInsensitively(
-              { Authorization: TOKEN },
-              'authorization',
-            ),
-          ).toEqual(TOKEN);
-          expect(
-            getObjFieldCaseInsensitively(
-              { AUTHORIZATION: TOKEN },
-              'authorization',
-            ),
-          ).toEqual(TOKEN);
-          expect(
-            getObjFieldCaseInsensitively(
-              { AuThOrIzAtIoN: TOKEN },
-              'authorization',
-            ),
-          ).toEqual(TOKEN);
-        });
-
-        it('No auth token', async () => {
-          expect(
-            getObjFieldCaseInsensitively({ Authorizatio: '' }, 'authorization'),
-          ).toEqual('');
-          expect(getObjFieldCaseInsensitively({}, 'authorization')).toEqual('');
-        });
-      });
-
       describe("when there's an error while retrieving json", () => {
         it('fails with an error', async () => {
           const mockedResponse: Response = {

plugins/scaffolder-actions/scaffolder-backend-module-http-request/src/actions/run/helpers.ts

@@ -86,12 +86,3 @@ export const http = async (
   }
   return { code: res.status, headers, body };
 };
-
-export const getObjFieldCaseInsensitively = (obj = {}, fieldName: string) => {
-  const [, value = ''] =
-    Object.entries<string>(obj).find(
-      ([key]) => key.toLowerCase() === fieldName.toLowerCase(),
-    ) || [];
-
-  return value;
-};

plugins/scaffolder-actions/scaffolder-backend-module-http-request/src/module.ts

@@ -31,11 +31,12 @@ export const scaffolderBackendModuleHttpRequest = createBackendModule({
     registerInit({
       deps: {
         scaffolder: scaffolderActionsExtensionPoint,
+        auth: coreServices.auth,
         discovery: coreServices.discovery,
       },
-      async init({ scaffolder, discovery }) {
+      async init({ scaffolder, auth, discovery }) {
         scaffolder.addActions(
-          backendModuleHttp.createHttpBackstageAction({ discovery }),
+          backendModuleHttp.createHttpBackstageAction({ auth, discovery }),
         );
       },
     });